Harden naive proxy auth handling

.github/workflows/build.yml

@@ -5,6 +5,8 @@ on:
     paths-ignore: [README.md]
   release:
     types: [published]
+permissions:
+  contents: read
 defaults:
   run:
     shell: bash
@@ -112,6 +114,8 @@ jobs:
   linux:
     needs: cache-toolchains-posix
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -192,6 +196,8 @@ jobs:
   android:
     needs: cache-toolchains-posix
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -289,6 +295,8 @@ jobs:
   win:
     needs: cache-toolchains-win
     runs-on: windows-2022
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -353,6 +361,8 @@ jobs:
   mac-x64:
     needs: cache-toolchains-mac-x64
     runs-on: macos-15-intel
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -404,6 +414,8 @@ jobs:
   mac-arm64:
     needs: cache-toolchains-mac-arm64
     runs-on: macos-15
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -455,6 +467,8 @@ jobs:
   openwrt:
     needs: cache-toolchains-posix
     runs-on: ubuntu-22.04
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:

src/net/tools/naive/http_proxy_server_socket.cc

@@ -363,8 +363,7 @@ int HttpProxyServerSocket::DoHeaderReadComplete(int result) {
     std::optional<std::string> proxy_auth;
     proxy_auth = headers.GetHeader(HttpRequestHeaders::kProxyAuthorization);
     if (proxy_auth != basic_auth_) {
-      LOG(WARNING) << "Invalid Proxy-Authorization: "
-                   << proxy_auth.value_or("");
+      LOG(WARNING) << "Invalid Proxy-Authorization";
       return ERR_INVALID_ARGUMENT;
     }
   }

src/net/tools/naive/socks5_server_socket.cc

@@ -9,6 +9,7 @@
 
 #include "net/tools/naive/socks5_server_socket.h"
 
+#include <cstdint>
 #include <cstring>
 #include <utility>
 
@@ -433,15 +434,16 @@ int Socks5ServerSocket::DoAuthReadComplete(int result) {
                                      "version", buffer_[0]);
       return ERR_SOCKS_CONNECTION_FAILED;
     }
-    int username_len = buffer_[1];
+    int username_len = static_cast<uint8_t>(buffer_[1]);
     read_header_size_ += username_len + 1;
     next_state_ = STATE_AUTH_READ;
     return OK;
   }
 
   if (buffer_.size() == read_header_size_) {
-    int username_len = buffer_[1];
-    int password_len = buffer_[kAuthReadHeaderSize + username_len];
+    int username_len = static_cast<uint8_t>(buffer_[1]);
+    int password_len =
+        static_cast<uint8_t>(buffer_[kAuthReadHeaderSize + username_len]);
     size_t password_offset = kAuthReadHeaderSize + username_len + 1;
     if (buffer_.size() == password_offset && password_len != 0) {
       read_header_size_ += password_len;